The following passwords are for extracting the firmware, '''not''' accessing the live box!

+

+

=== Firmware 1.63 ===

+

+

Use the following password:

+

+

YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4

+

+

=== Firmware 1.62 ===

+

+

Use the following password:

+

+

1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l

+

+

=== Firmware 1.60 ===

+

+

Use the following password:

+

+

YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4

=== Firmware 1.58 ===

=== Firmware 1.58 ===

Line 90:

Line 110:

cd ../root

cd ../root

mkdir .ssh

mkdir .ssh

+

chmod 700 .ssh

cp $HOME/.ssh/authorized_keys .ssh/authorized_keys

cp $HOME/.ssh/authorized_keys .ssh/authorized_keys

+

chmod 600 .ssh/authorized_keys

'''4) create the hddrootfs.buffalo.updated again'''

'''4) create the hddrootfs.buffalo.updated again'''

Line 105:

Line 127:

zip -e hddrootfs.img hddrootfs.buffalo.updated

zip -e hddrootfs.img hddrootfs.buffalo.updated

−

+

'''6) Perform the update using the normal Buffalo updater (probably after [http://www.youtube.com/watch?v=Pu4HI6XoSB8 enabling the debug option] to reload the image)'''

'''6) Perform the update using the normal Buffalo updater (probably after [http://www.youtube.com/watch?v=Pu4HI6XoSB8 enabling the debug option] to reload the image)'''

−

'''7) Use ssh to root@ip_address'''

+

'''7) See the notes about editing the /etc/nas_feature file below and elsewhere on this WIKI.'''

+

+

''' This is a file that is generated during boot time. ''' The entry SUPPORT_SFTP=0 needs to be changed to SUPPORT_SFTP=1 in order for sshd to start via /etc/init.d/sshd.sh. The following acp_commander command may work post reboot:

LinkStation Duo (LS-WXL)

Variants

Commercial description

The LinkStation™ Duo is a high performance, multimedia, shared RAID network storage solution for the home and small office that requires a central location to share data files, photos, video and music.

The unit is a two drive NAS solution that can be configured in RAID 0 for performance or RAID 1 for redundant storage. In addition to the storage capabilities, stream multimedia to a PC, a Mac, a Buffalo™ LinkTheater™ and other DLNA CERTIFIED™ or UPNP media player, as well as sharing movies, photos and documents in a home or small business network via the Internet with the WebAccess feature. The LinkStation™ Duo seamlessly integrates with iTunes® and allows access to music files from your iTunes® software.

With features such as enhanced performance of up to 40MB/s, quick swap via the front panel with two removable drives and easy set-up via a simple web interface, the LinkStation™ Duo is the perfect solution to store, save & share your digital life from one central place.

Gain SSH Access

The following passwords are for extracting the firmware, not accessing the live box!

Firmware 1.63

Use the following password:

YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4

Firmware 1.62

Use the following password:

1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l

Firmware 1.60

Use the following password:

YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4

Firmware 1.58

Use the following password:

IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty

Firmware 1.57

Use the following password:

1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l

Firmware 1.56

Use the following password:

aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB

Firmware 1.54

Use the following password:

1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l

Firmware 1.52

Use the following password:

IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty

Firmware 1.42

Use the following password:

IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty

Firmware 1.41 and later

In this version, it appears that acp_commander no longer provides the capability to execute commands, which prevents most earlier strategies from working. However, it is quite straightforward to solve this problem by using a custom firmware image. The basic principle is described in Create a custom firmware image.

Start with the files downloaded from Buffalo's website. Then, ideally on a Linux platform of some sort...

1) unzip the hddrootfs.img

unzip hddrootfs.img

provide the right password for the firmware.

For version 1.41, the third zip password listed in the above mentioned reference proved successful:

YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4

The result of this is a hddrootfs.buffalo.updated...this is the tared root-filesystem of the firmware image.

7) See the notes about editing the /etc/nas_feature file below and elsewhere on this WIKI.

This is a file that is generated during boot time. The entry SUPPORT_SFTP=0 needs to be changed to SUPPORT_SFTP=1 in order for sshd to start via /etc/init.d/sshd.sh. The following acp_commander command may work post reboot:

Firmware 1.40

Method 1

Method 2

Firmware 1.40 has a different sshd_config with 'PermitRootLogin' set to 'no'. The permissions on this file are not open like the pam sshd file, so it is necessary to add a back door prior to upgrading to 1.40. One technique would be to perform the following

After the firmware upgrade is complete, you can add commands to /tmp/cron.root.sh and they will be executed once a minute with root privileges. You can use this to replace the sshd_config. You may also wish to keep the cron job enabled in case of future issues, though it does pose a security risk.

Firmware prior to 1.40

Tested with firmware v1.33 and v1.34, but does not work with v1.40.
It is possible to gain root access via the web server.

1. Create a shared folder name 'www'

2. Enable the web server in Network -> Web Server

3. Set the Port No. 81

4. Set the target folder to www

5. The default index.php is showing phpinfo();

6. Now with PHP enabled, you can edit /etc/pam.d/sshd via a simple script

NOTE: acp_commander may complain about the password being incorrect but this should not affect the outcome. This second method was tested with firmware v1.34. You could potentially use interactive mode in acp_commander (the -s option) to save keystrokes, but the basic approach is the same.

At this point you should be able to get root access without the need of the password. To maintain root access, the public key recommendation remains as noted above. However, every time the box restarts and /etc/pam.d/sshd is replaced, you could rerun the third command above to regain root access without the password.

IPKG

Once you have root access, you can start to install packages from IPKG. To do so, first run the following

Finally, create an /etc/exports file according to taste, and start everything:

cd /opt/etc/init.d
S55portmap start
S99nfs start

You're done.

TeraStation "Conversion"

The LinkStation LS-WXL series runs on very similar hardware to the some of the TeraStation systems, particularly the TS-XEL "ES" machines. TeraStations tend to come with more features than LinkStations (e.g. support for NFS and iSCSI), so there are obvious advantages in making a LinkStation behave like a TeraStation.

The strategy is simple: find a TeraStation firmware release with the same kernel as a LinkStation release, and make a hybrid distribution consisting of the LinkStation boot files with the TeraStation filesystem. As part of this, you will need to defeat the scheme used to restrict the capabilities of the LinkStations so that you can enable e.g. NFS.

It so happens that LS-WXL firmware version 1.58 matches the TeraStation ES version 1.55.

Start with the files downloaded from Buffalo's website for both the LinkStation and the TeraStation. Note that the TeraStation download process may require that you enter a TS ES serial number. There may be ways around this, though.

The LS updater is the one that will be used to load the modified firmware.

6) Now to defeat the "limited functionality" scheme
This is controlled by a file called "/etc/nas_features". This file is created during the boot process, based on a combination of stored values and pre-defined settings based on the machine's product ID. Because it is created during boot, you cannot just edit the thing.

Perhaps the simplest, but least elegant, approach is to grep for every file that uses a feature variable (such as "SUPPORT_NFS") that you want, and edit out the test so that no matter what the value of the variable ("SUPPORT_NFS") might be, the system does what you want.

A slightly more elegant approach is to create a boot script that runs early in the process which updates /etc/nas_features to suit your taste. One simple way to do this would be to have a copy of the file modified as you want and then overwrite the one created by the system with your copy.

The cleanest approach is to get rid of the problem entirely:

6A) Modify the initrd.img

The full details of how to do this are beyond the scope of this, but the mechanics can be found here: How to modify an initrd (remember this is an ARM system, so ignore the PPC and MIPS stuff). All that needs to be done is to delete the appropriate feature files; if you are working with an LS-WXL, then it's product ID is 0x00003006 (you can find this in a number of ways, including logging into a running system and running:

cat /proc/buffalo/firmware

Assuming that your product ID is 0x00003006, then the files to delete are:

rm root/.nas_features/*/0x00003006

(The '*' is because each country code has a separate feature file, so that Buffalo can sell the same system with different features depending on the country. Which is a bit odd, because then someone who spoke e.g. Japanese could get the Japanese feature set simply by setting the NAS to that language! So we just get rid of all of the country control files).

Once you get the system running again, you will be able to log in, and use
Repack the initrd.img file with the same password as you used to unpack it (i.e. probably not the PasswordA one).

7) create the new hddrootfs.buffalo.updated
(you should be in the folder where you extracted the image)

CAUTION: you want to use the LinkStation password, PasswordA, not the TeraStation one you used to unpack it. If you use the wrong password, the firmware updater / the LinkStation will fail to unzip the hddrootfs.img during the update.

10) Use ssh to root@ip_address
You can now either edit the startup scripts (as mentioned in step 6), or set the features is you followed step 6A and changed the initrd.img file.

If you did use a modified initrd.img, the features can be enabled by using the "dumpnf" and "setnf" commands to read or write the stored feature set. But take care not to enable something that you lack the hardware to support, such as RAID5 on a two disk system!
For example: